8785 matches found
MAL-2024-9069 Malicious code in @b2bneo/components-tabs (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a1d577f52f10cee6de3de2dee9eb8d3d70fb94c04b41f3dfb93794409066d6c8 The OpenSSF Package Analysis project identified '@b2bneo/components-tabs' @ 1.3.0 npm as malicious. It is considered malicious because: - The...
OCSP stapling bypass with GnuTLS
...
Stable Channel Update for ChromeOS / ChromeOS Flex
The Stable channel is being updated to OS version: 16002.44.0 Browser version: 129.0.6668.80 for most ChromeOS devices. If you find new issues, please let us know one of the following ways 1. File a bug 2. Visit our ChromeOS communities 1. General: Chromebook Help Community 2. Beta Specific:...
Synology DiskStation Manager Path Traversal (CVE-2013-6987)
Multiple directory traversal vulnerabilities in the FileBrowser components in Synology DiskStation Manager DSM before 4.3-3810 Update 3 allow remote attackers to read, write, and delete arbitrary files via a .. dot dot in the 1 path parameter to filedelete.cgi or 2 folderpath parameter to...
CVE-2024-9202
In Eclipse Dataspace Components versions 0.1.3 to 0.9.0, the Connector component filters which datasets = data offers another party can see in a requested catalog, to ensure that only authorized parties are able to view restricted offers. However, there is the possibility to request a single...
CVE-2024-9202 EDC DataSetResolver policy filtering missing
In Eclipse Dataspace Components versions 0.1.3 to 0.9.0, the Connector component filters which datasets = data offers another party can see in a requested catalog, to ensure that only authorized parties are able to view restricted offers. However, there is the possibility to request a single...
CVE-2024-9202 EDC DataSetResolver policy filtering missing
In Eclipse Dataspace Components versions 0.1.3 to 0.9.0, the Connector component filters which datasets = data offers another party can see in a requested catalog, to ensure that only authorized parties are able to view restricted offers. However, there is the possibility to request a single...
CVE-2024-9202
CVE-2024-9202 affects Eclipse Dataspace Components versions 0.1.3–0.9.0. The Connector’s catalog filtering fails for single-dataset requests, potentially allowing unauthorized parties to view restricted datasets. The issue stems from missing filtering in the DatasetResolverImpl (lines 76–79). Exp...
Eclipse Dataspace Components 安全漏洞
Eclipse Dataspace Components is a development connector for the Eclipse Dataspace Components open source. A security vulnerability exists in Eclipse Dataspace Components versions 0.1.3 through 0.9.0, which stems from a lack of proper filtering to expose sensitive information...
PT-2024-39485 · Eclipse · Eclipse Dataspace Components
Name of the Vulnerable Software and Affected Versions: Eclipse Dataspace Components versions 0.1.3 through 0.9.0 Description: The issue concerns the Connector component in Eclipse Dataspace Components, which is responsible for filtering datasets that another party can see in a requested catalog...
Malicious code in design-system-components-angular (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fa76659f890e0326b1b129f7cf3c39dd4b242fa297217ef6b98e4b34fa602ba2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-8958 Malicious code in livingdesign-components (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fa9ad15e8dcaf3a6c94d2739771d75df50a809e5356b448918bf83199d2688e8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in livingdesign-components (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fa9ad15e8dcaf3a6c94d2739771d75df50a809e5356b448918bf83199d2688e8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
The vulnerability of Microsoft Edge and Google Chrome browsers’ authentication components allows attackers to access sensitive data, compromise its integrity, and cause service interruptions.
The vulnerability of Microsoft Edge and Google Chrome browsers’ authentication components is related to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to gain access to confidential data, compromise its integrity, and cause service interruptions...
The vulnerability of the Mojo components in Microsoft Edge and Google Chrome browsers allows attackers to access confidential data, compromise its integrity, and cause service interruptions.
The vulnerability of the Mojo browser components in Microsoft Edge and Google Chrome is related to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to access confidential data, compromise its integrity, and cause service interruptions through a specially...
SOFA Hessian Remote Command Execution (RCE) Vulnerability
Impact SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. But there is a gadget chain that can bypass the SOFA Hessian blacklist protection mechanism, and this gadget chain only relies on JDK and does not rely on...
@angular/build (>=18.0.0 <=18.1.0-next.2), @d-zero/builder (>=5.0.0-alpha.4 <=5.0.0-alpha.10) +53 more potentially affected by CVE-2024-45811 via vite (>=5.2.0 <=5.2.13)
vite NPM version =5.2.0, =18.0.0, =5.0.0-alpha.4, =0.1.0-rc.8, =3.0.2, =3.5.0, =4.1.0, =34.0.0, =2.1.3, =1.2.0, =1.0.0, =11.17.0, =8.0.8, =1.1.7, =0.0.0-dev-20240613084836, =0.45.0 and more Source cves: CVE-2024-45811 Source advisory: OSV:GHSA-9CWX-2883-4WFX...
Security Bulletin: IBM Security QRadar Analyst Workflow for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities
Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. The update addresses these issues. Vulnerability Details CVEID:CVE-2023-45857 DESCRIPTION: Axios is vulnerable to cross-site request forgery, caused by improper...
CVE-2024-44187
A cross-origin issue existed with "iframe" elements. This was addressed with improved tracking of security origins. This issue is fixed in Safari 18, iOS 18 and iPadOS 18, macOS Sequoia 15, tvOS 18, visionOS 2, watchOS 11. A malicious website may exfiltrate data cross-origin...